Privacy policy — artsarychev.ru

1. General provisions

1.1. This Personal Data Processing Policy (the Policy) is drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the Personal Data Law) and sets out the procedure for processing personal data and the measures to keep it secure taken by the personal data operator — Artem Valeryevich Sarychev (the Operator).

1.2. Operator details: Artem Valeryevich Sarychev, an individual applying the special tax regime “Professional Income Tax” (self-employed), taxpayer ID (INN) 753102826709, email for requests: info@artsarychev.ru.

1.3. The Operator’s most important goal and condition of its activity is respecting the rights and freedoms of a person and citizen when processing their personal data, including protecting the rights to privacy and personal and family secrets.

1.4. The Policy applies to all information the Operator may receive about visitors of the website artsarychev.ru (the Website).

1.5. The Policy is published in open access on the Website; a link to it is placed on every page of the Website and next to every form that collects personal data.

1.6. Recording, systematisation, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation.

2. Key terms

Website — the set of graphic and information materials, computer programs and databases available on the Internet at artsarychev.ru.
User — any visitor of the Website.
Personal data — any information relating directly or indirectly to an identified or identifiable natural person (personal data subject).
Personal data processing — any action (operation) or set of actions with personal data, performed with or without automation: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.
Automated processing — processing of personal data using computer equipment.
Provision of personal data — actions aimed at disclosing personal data to a certain person or a certain group of persons.
Dissemination of personal data — actions aimed at disclosing personal data to an indefinite group of persons.
Blocking — temporary suspension of personal data processing (except when processing is needed to clarify the personal data).
Destruction — actions that make it impossible to restore the content of personal data in an information system and (or) destroy the physical media of personal data.
Depersonalisation — actions that make it impossible, without additional information, to tell which specific subject the personal data belongs to.
Cross-border transfer — transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign natural or legal person.
Cookies — small pieces of data the Website stores in the User’s browser for the Website to work and to collect visit statistics.
Metrics program — a service for collecting and analysing Website visit statistics (Yandex Metrica), enabled only with the User’s consent.

3. Rights and obligations of the Operator

3.1. The Operator has the right to:

receive reliable information and (or) documents containing personal data from the personal data subject;
if consent is withdrawn or termination of processing is requested, continue processing without consent where there are grounds set out in the Personal Data Law;
determine independently the set and list of measures necessary and sufficient to fulfil the obligations set out in the Personal Data Law;
entrust personal data processing to another person under a contract in compliance with Part 3 of Article 6 of the Personal Data Law.

3.2. The Operator must:

organise personal data processing in accordance with the legislation of the Russian Federation;
provide the personal data subject, upon request, with information about the processing of their personal data within 10 (ten) working days from the date of the request; this period may be extended by no more than 5 (five) working days with a reasoned notice sent to the subject;
provide the authorised body for the protection of the rights of personal data subjects (Roskomnadzor), upon its request, with the necessary information within 10 (ten) working days from the date of the request;
publish or otherwise provide unrestricted access to this Policy;
take legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions;
stop processing and destroy personal data in the manner and cases set out in the Personal Data Law;
notify Roskomnadzor of personal data processing and of changes to previously submitted information, as well as of computer incidents that led to unlawful transfer of personal data, within the time limits set by Part 3.1 of Article 21 of the Personal Data Law;
fulfil other obligations set out in the Personal Data Law.

4. Rights and obligations of personal data subjects

4.1. The personal data subject has the right to:

receive information about the processing of their personal data, except in cases set out by federal laws;
demand that their personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
withdraw consent to the processing of personal data and send a demand to stop processing;
appeal against actions or inaction of the Operator to Roskomnadzor or in court;
exercise other rights provided by the legislation of the Russian Federation.

4.2. The personal data subject must provide the Operator with reliable information about themselves and must not transfer personal data of third parties without their consent. Persons who provided the Operator with false information or information about another subject without their consent are liable in accordance with the legislation of the Russian Federation.

5. Principles of personal data processing

Processing is carried out on a lawful and fair basis.
Processing is limited to achieving specific, predetermined and lawful purposes; processing incompatible with the purposes of collection is not allowed.
Combining databases containing personal data processed for incompatible purposes is not allowed.
Only personal data that meets the purposes of processing is processed; its content and volume match the stated purposes, and excess is not allowed.
The accuracy, sufficiency and, where necessary, relevance of personal data in relation to the purposes of processing are ensured.
Personal data is stored in a form that allows the subject to be identified for no longer than the purposes of processing require, and is destroyed once the purposes are achieved or no longer need to be achieved.

6. Purposes, categories and periods of personal data processing

6.1. The Operator processes personal data for the following purposes.

6.1.1. Processing requests received through forms on the Website

Purpose of processing: receiving and processing requests for a call, a website audit and a project discussion; contacting the User by the method they chose (Telegram, WhatsApp, MAX) to respond to the request; consulting and preparing a proposal.
Categories of subjects: Website Users who sent a request, including representatives of organisations.
Personal data: name; the chosen contact method and contact: a Telegram username or link, or a phone number for WhatsApp or MAX; the User’s website address, if provided; review text and other information, if the User voluntarily provided it in the form; the address of the Website page from which the request was sent, the date and time of sending.
Legal basis: consent of the personal data subject (Clause 1, Part 1, Article 6 of the Personal Data Law).
Processing actions and methods: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, blocking, deletion, destruction; mixed processing — with and without automation.
Processing and storage period: until the purpose of processing is achieved, but no longer than 1 (one) year from the date the request was received, or until consent is withdrawn.

6.1.2. Concluding and performing a contract

Purpose of processing: concluding and performing a service contract at the User’s initiative, payments, issuing receipts, keeping income records in accordance with tax legislation.
Categories of subjects: Customers of the Operator’s services and their representatives.
Personal data: surname, first name, patronymic; contact details: phone number, email address, messenger username; details needed to conclude the contract and make payments (if the customer is an organisation or an individual entrepreneur — the representative’s details).
Legal basis: concluding and performing a contract to which the personal data subject is a party (Clause 5, Part 1, Article 6 of the Personal Data Law), as well as fulfilling obligations imposed by law (Clause 2, Part 1, Article 6).
Processing actions and methods: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (provision) in cases provided by law, blocking, deletion, destruction; mixed processing.
Processing and storage period: for the term of the contract and 5 (five) years after its performance — the document retention period set by tax legislation.

6.1.3. Website visit statistics

Purpose of processing: analysing Website traffic, assessing how convenient and effective the materials are, improving the Website.
Categories of subjects: Website visitors who consented to the use of cookies for analytics.
Personal data: IP address; cookie identifiers; information about the browser, operating system, device and screen resolution; referral source, pages viewed, actions on the Website, date and time of the visit.
Legal basis: consent of the personal data subject, expressed by clicking the “Accept” button in the cookie notice (Clause 1, Part 1, Article 6 of the Personal Data Law).
Processing actions and methods: collection, recording, systematisation, accumulation, storage, use, depersonalisation, transfer (provision) to a person processing data on the Operator’s instructions, deletion, destruction; automated processing.
Processing and storage period: until consent is withdrawn, but no longer than 1 (one) year from the date it was given.

6.1.4. Keeping the Website running and secure

Purpose of processing: keeping the Website running, protecting forms from spam and automated submissions, protecting against password guessing and other attacks, counting article views, investigating failures and incidents.
Categories of subjects: Website visitors.
Personal data: IP address; information about the browser and device (user agent); the address of the requested page, date and time of the request; information about failed login attempts to the Website admin area.
Legal basis: processing is necessary to exercise the rights and legitimate interests of the Operator, provided that the rights and freedoms of the personal data subject are not violated (Clause 7, Part 1, Article 6 of the Personal Data Law).
Processing actions and methods: collection, recording, storage, use, deletion, destruction; automated processing. To limit the number of requests and to count article views, the IP address is stored only as an irreversible hash — for no longer than 12 (twelve) hours.
Processing and storage period: no longer than 6 (six) months from the date of the request (hosting logs).

6.2. The Operator does not process special categories of personal data (including health information) or biometric personal data. Client reviews with their name and photo are published on the Website only with a separate consent to dissemination of personal data (Article 10.1 of the Personal Data Law), which the Operator obtains from the review’s author separately.

6.3. The Operator does not make decisions that have legal consequences for the personal data subject or otherwise affect their rights based solely on automated processing of personal data.

7.1. The User gives consent to the processing of personal data when submitting a form on the Website by ticking the consent box next to the form; the box is not ticked in advance. The text of the consent is a separate document — “Consent to the processing of personal data”. The form is not sent without the tick.

7.2. The User gives consent to the use of cookies for visit statistics by clicking the “Accept” button in the cookie notice. Until the button is clicked, the metrics program is not loaded on the Website. The “Decline” button means refusing analytics; the Website still works fully.

8.1. The Website uses cookies and similar technologies for storing data in the browser:

necessary — remember the User’s choice in the cookie notice; without them the Website cannot take this choice into account. Not passed to third parties;
analytical — cookies of the Yandex Metrica service that allow visit statistics to be collected. Set only after the “Accept” button is clicked.

8.2. The User may change their choice and withdraw consent to analytical cookies at any time: open the notice with the “Cookie settings” link in the Website footer and click “Decline” — Metrica will be switched off and its cookies deleted. You can also delete cookies in your browser settings, install the Yandex Metrica blocker or send the Operator a withdrawal of consent as described in section 11.

8.3. The Website contains videos. Until the play button is clicked, only a cover image stored on the Website’s server is shown; third-party services are not loaded. After the click, the player of the service hosting the video (YouTube, Rutube or VK Video) is loaded. The User’s browser passes to this service the IP address and technical information needed to show the video, and the service may set its own cookies. The owner of the service processes this data on its own under its privacy policy; the Operator does not receive it. YouTube belongs to the foreign company Google LLC.

8.4. The “Share” buttons are ordinary links to social networks and messengers: no data is passed to these services until they are clicked.

9. Transfer of personal data to third parties

9.1. The Operator does not sell or disseminate personal data. Personal data may be transferred only:

to the person hosting the Website on servers located in the Russian Federation — to the extent necessary for the Website to work and to store requests, under a contract with the Operator;
to the Operator’s email service with servers in the Russian Federation — for the Operator to receive notifications of new requests;
to YANDEX LLC (INN 7736207543, 16 Lva Tolstogo St., Moscow, 119021) — for collecting visit statistics with the Yandex Metrica service on the Operator’s instructions, only with the User’s consent to analytical cookies;
to state authorities — in the cases and manner expressly provided by the legislation of the Russian Federation.

9.2. Persons processing data on the Operator’s instructions must comply with the principles and rules of processing set out in the Personal Data Law and ensure the confidentiality and security of personal data.

9.3. The notification of a new request that the Operator receives in the Telegram messenger contains only the type of request, the time it arrived and a link to the Website admin area — without the User’s personal data.

9.4. The Operator does not carry out cross-border transfer of personal data.

10. Security measures

10.1. The Operator takes necessary and sufficient legal, organisational and technical measures, including:

organises the processing and protection of personal data on its own and is responsible for it;
restricts access to personal data: the Website admin area and the mailbox receiving requests are password-protected, and only the Operator has access to them;
uses a secure connection (HTTPS) for data sent from the Website, protection of forms from automated submissions, a limit on login attempts to the admin area and backups;
carries out internal control of compliance of personal data processing with the requirements of the Personal Data Law.

11. Requests of subjects, clarification, termination of processing and destruction

11.1. Requests, demands to clarify, block or destroy personal data, and withdrawal of consent are sent to the Operator at info@artsarychev.ru marked “Personal data”. The request must contain information that allows the subject to be identified and their relationship with the Operator to be confirmed (for example, the contact given in the request).

11.2. The Operator responds to a request within 10 (ten) working days from the date it was received; this period may be extended by no more than 5 (five) working days with a reasoned notice.

11.3. If inaccurate personal data is found, the Operator clarifies it within 7 (seven) working days from receiving confirming information; if unlawful processing is found, it stops it within 3 (three) working days, and if lawfulness cannot be ensured, destroys the personal data within 10 (ten) working days.

11.4. When the purposes of processing are achieved or no longer need to be achieved, and when consent is withdrawn, the Operator stops processing and destroys the personal data within 30 (thirty) days, unless otherwise provided by contract or federal law.

11.5. If the personal data cannot be destroyed within this period, the Operator blocks it and destroys it within no more than 6 (six) months, unless another period is set by federal laws.

11.6. Personal data in information systems is destroyed by deleting the records without the possibility of recovery, and on physical media in a way that rules out recovery. The destruction is documented in the manner set by Roskomnadzor.

12. Final provisions

12.1. The Operator may amend the Policy. The new version takes effect when it is published on the Website, unless the new version provides otherwise. The current version is always available at https://artsarychev.ru/en/privacy-policy/.

12.2. Matters not covered by the Policy are governed by the personal data legislation of the Russian Federation.